Blackhole Exploit Kit Run Adopts Controversial Java Flaw

In our 2013 Security Predictions, we predicted that conventional malware will focus mainly on refining tools instead of creating new threats. A perfect example of this prediction is how Blackhole Exploit Kit continuously attempts to circumvent the efforts done by the security industry. True enough, we recently received reports of a Blackhole Exploit Kit (BHEK) run that incorporated an exploit (detected by Trend Micro as JAVA_ARCAL.A) targeting the recently patched CVE-2013-0431.

If users can still recall, this vulnerability is part of the Java zero-day ruckus last January. This slew of critical incidents led Oracle to release an out-of-band security update to quickly address the issue. However, this release raised some crucial questions.

This particular BHEK run starts with spammed messages spoofing PayPal. When users click the item number indicated in these messages, they are led to several redirecting sites until they arrive at the page hosting the encrypted BHEK code. This code then checks the vulnerable system for versions of Adobe Reader, Flash Player, and Java. This determines which exploit (and subsequent payload) are downloaded onto the system.

Figure 1. Sample spoofed PayPal email message

In the testing we did, the BHEK code found certain versions of Adobe Reader, which prompted it to download and execute a malicious .PDF file (detected as TROJ_PIDIEF.MEX), which exploits an old vulnerability in CVE-2010-0188.

This BHEK code also downloads and executes JAVA_ARCAL.A from a specific page after checking the Java version of the infected system. JAVA_ARCAL.A then downloads and executes TSPY_FAREIT.MEX by using command.exe in the PATH %user% in a specific URL. This routine opens another page. Based on our analysis, TSPY_FAREIT.MEX attempts to steal information stored in web browsers like Google Chrome, Mozilla Firefox and Internet Explorer. At the end of the infection chain, this BHEK code will access the malicious page below to lead users into thinking that they’re just redirected to a seemingly non-malicious website.

Figure 2. Final landing page of the infection chain

Using Trend Micro Smart Protection Network™ data, we looked into the most affected countries by this BHEK run and got some interesting results. The most affected country is the United States, followed by Mexico. This is quite surprising, as Mexico did not generate significant infection counts in the past BHEK runs. Other countries most affected by this wave of BHEK include Germany, Latvia, Japan, Australia, United Kingdom, France, Spain and Italy.

With several components involved in this threat, BHEK spam runs can overwhelm any user. Fortunately, Trend Micro Smart Protection Network protects users from the related spam, URL, and malware.

The entry of CVE-2013-0431 into the BHEK narrative proves that this threat won’t be fading anytime soon. To better protect themselves from this threat, users must regularly keep their systems and software up-to-date.

For the spam component of this threat, it is also crucial for users and security administrators alike to realize that the usual spam and phishing best practices are not effective to address BHEK spam runs. We previously released our report Blackhole Exploit Kit: A Spam Campaign, Not a Series of Individual Spam Runs, which goes into details about our finding regarding the BHEK runs.

Users can visit the following blog posts for security tips on how to safely use PDF files and Java:

Security Predictions for 2018

Attackers are banking on network vulnerabilities and inherent weaknesses to facilitate massive malware attacks, IoT hacks, and operational disruptions. The ever-shifting threats and increasingly expanding attack surface will challenge users and enterprises to catch up with their security.Read our security predictions for 2018.

Business Process Compromise

Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more,
read our Security 101: Business Process Compromise.